Polaris — Best Practices Validation for Kubernetes Clusters

What it is

Polaris is an open-source tool by Fairwinds that validates Kubernetes resources against a configurable set of best practices. It catches misconfigurations like missing resource limits, containers running as root, and missing health checks before they cause outages or security incidents.

Polaris runs in three modes: a CLI audit tool for local checks, a web dashboard for cluster-wide visibility, and a validating admission webhook that blocks non-compliant deployments at apply time.

How it saves time or tokens

Polaris automates the manual review of Kubernetes manifests that platform teams typically do in pull requests. Instead of checking each deployment for resource limits, security contexts, and health probes manually, Polaris runs a configurable set of checks automatically. In CI/CD pipelines, it catches issues before they reach the cluster. As an admission controller, it prevents non-compliant resources from being created at all, reducing incident response time.

How to use

1. Install and run the CLI audit:

brew install FairwindsOps/tap/polaris
polaris audit --format=pretty

1. Audit a single YAML file in CI:

polaris audit --audit-path deployment.yaml --format=json

1. Run the dashboard for a visual cluster overview:

polaris dashboard --port 8080
# Open http://localhost:8080

Example

A Kubernetes deployment that passes all Polaris checks:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
spec:
  replicas: 2
  selector:
    matchLabels:
      app: api-server
  template:
    spec:
      securityContext:
        runAsNonRoot: true
      containers:
        - name: api
          image: myapp:v1.2.3  # pinned tag, not latest
          securityContext:
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080

Related on TokRepo

• DevOps tools — More Kubernetes and infrastructure tools on TokRepo.
• Security tools — Browse security validation and auditing tools.

Common pitfalls

• Running Polaris audit without customizing the config scores legacy workloads harshly. Adjust severity levels and disable irrelevant checks for your environment.
• Deploying the admission webhook without a dry-run period blocks legitimate deployments. Start in audit mode, review results, then switch to enforcement.
• Not integrating Polaris into CI/CD means issues are caught too late. Add polaris audit to your pipeline to shift validation left.